CVE-2022-2222

CVE-2022-2222 describes a directory traversal vulnerability in the Download Monitor WordPress plugin prior to version 4.5.91. This flaw allows high-privilege users, such as administrators, to download sensitive files like wp-config.php or /etc/passwd, even in hardened or multisite environments. Rated with a CVSS score of 4.9 (Medium), the vulnerability has a network attack vector and low attack complexity, leading to high confidentiality impact. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.